ID. Date of interview 
date 29/12/19 


ID. — Time interview started 
start 44:15:12 


ID.end Completion date of interview 
Date 29/12/19 


ID.end Time interview ended 
11:24:49 


ID. Duration of interview 
time 9.62 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 
from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


I don't have any examples - but I feel the new draft guidance is very helpful. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


3- 
1-Notatall 2-—Slightly Moderately 4-—Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 
It covers the range of cases I could envision for our organisation. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


C) () ( ) o) © 


Q8 


Q9 


Q10 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


1. I would like some more detailed guidance around the record keeping of a SAR. In 
particular, what level of record keeping is *required* and what level of record 
keeping is *recommended*. In particular, some guidance on retention horizons, and 
what (if any) anonymised records should be kept relating to a SAR after any 
retention horizons have passed. What would be most helpful would be an example of 
a the kind of record keeping for SARs which would be expected. 2. I would like 
some more guidance on the subject of emails. In particular an example along the 
lines of: A long term former employee has requested "all of their data". Their 
company email address contains their name and so would constitute as their data. 
They have been included on thousands of internal email addresses, most of which 
are general information and relate only to the former employee in that their email 
address in contained in the distribution list. Some emails however will require 
redacting as they contain information relating to other people. What would the 
expectation on a small business be to sift through all the emails applying appropriate 
redaction - or is there another way of responding to such a request? 3. Can you 


Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

C) Other 

Please specify the name of your organisation: 

tails.com 

What sector are you from: 

pet food 


How did you find out about this survey? 
©) ICO Twitter account 
_) ICO Facebook account 
(`) ICO LinkedIn account 
(`) ICO website 
( `) ICO newsletter 
(_) ICO staff member 
(`) Colleague 
( ) Personal/work Twitter account 
( ) Personal/work Facebook account 
|) Personal/work LinkedIn account 
( ) Other 


If other please specify: 


